skip to main content

DOE PAGESDOE PAGES

Title: Cyber-Physical System Security With Deceptive Virtual Hosts for Industrial Control Networks

A challenge facing industrial control network administrators is protecting the typically large number of connected assets for which they are responsible. These cyber devices may be tightly coupled with the physical processes they control and human induced failures risk dire real-world consequences. Dynamic virtual honeypots are effective tools for observing and attracting network intruder activity. This paper presents a design and implementation for self-configuring honeypots that passively examine control system network traffic and actively adapt to the observed environment. In contrast to prior work in the field, six tools were analyzed for suitability of network entity information gathering. Ettercap, an established network security tool not commonly used in this capacity, outperformed the other tools and was chosen for implementation. Utilizing Ettercap XML output, a novel four-step algorithm was developed for autonomous creation and update of a Honeyd configuration. This algorithm was tested on an existing small campus grid and sensor network by execution of a collaborative usage scenario. Automatically created virtual hosts were deployed in concert with an anomaly behavior (AB) system in an attack scenario. Virtual hosts were automatically configured with unique emulated network stack behaviors for 92% of the targeted devices. The AB system alerted on 100% ofmore » the monitored emulated devices.« less
Authors:
 [1] ;  [1]
  1. Idaho National Lab. (INL), Idaho Falls, ID (United States)
Publication Date:
OSTI Identifier:
1136315
Report Number(s):
INL/JOU--14-32392
Journal ID: ISSN 1551-3203; TRN: US1500453
Grant/Contract Number:
AC07-05ID14517
Type:
Accepted Manuscript
Journal Name:
IEEE Transactions on Industrial Informatics
Additional Journal Information:
Journal Volume: 10; Journal Issue: 2; Journal ID: ISSN 1551-3203
Publisher:
IEEE
Research Org:
Idaho National Laboratory (INL), Idaho Falls, ID (United States)
Sponsoring Org:
USDOE
Country of Publication:
United States
Language:
English
Subject:
97 MATHEMATICS AND COMPUTING INDUSTRIAL CONTROL NETWORKS; VIRTUAL HOSTS